🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AZORult


Vendor detections: 6


Intelligence 6 IOCs 1 YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be
SHA3-384 hash: 5485e431eeea178571d6c8d64694fb65ca6b59705194d064b40f2000cc4b10313417f0393e40f06241c556a4b97099f9
SHA1 hash: aed4141ecdb8754f906f7ce571e2705e36e3d5e6
MD5 hash: 02b4fe8d20fbb40f6f198ad2e2bb4f05
humanhash: hot-romeo-potato-west
File name:PO & DATASHEET_1.zip
Download: download sample
Signature AZORult
Create hunting rule
File size:131'806 bytes
First seen:2023-03-24 08:25:19 UTC
Last seen:2023-03-24 08:25:24 UTC
File type: zip
MIME type:application/zip
ssdeep 3072:/sVXb3QSFe2MhkVgDdSBc7u6KGIFlubiDCC3XbCji2Ic2KPLDk:/sVrgglxudSBc7u6K7luYCCGe2R2Svk
TLSH T1CED30297FBDB8AC0DF9E33ED3ACA9624658FC34F6452A6BD3932A811F52100518D21F5
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter TeamDreier
Tags:AZORult zip

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
http://34.217.22.124/index.php https://threatfox.abuse.ch/ioc/1092971/

Intelligence

File Origin
# of uploads :
5
# of downloads :
136
Origin country :
n/a
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:PURCHASE ORDER.exe
File size:161'792 bytes
SHA256 hash: 4be5fa9ac61777638bf7550de77fffee6aa150b0e5c55612753f5fe3d931d885
MD5 hash: ce84573aa1706cc43cc2fea8a1c98447
MIME type:application/x-dosexec
Signature AZORult
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs3213.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.22360.ZipHeur.UNOFFICIAL
Create hunting rule

Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be/results/dashboard
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm obfuscated packed
Link:
https://www.filescan.io/uploads/641d5ea0009023b71dc29ea6/reports/199a9b9f-f01b-49da-86cc-d43287810df7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be/
Threat name:
Win32.Spyware.Azorult
Create hunting rule
Status:
Malicious
First seen:
2023-03-24 08:26:10 UTC
File Type:
Binary (Archive)
Extracted files:
22
AV detection:
20 of 24 (83.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qdekwtopmt42fpf6whxw6h4ldn6mwvidtqf242uzk7762cl7427a._file
Result
Malware family:
azorult
Create hunting rule
Score:
  10/10
Tags:
family:azorult collection infostealer spyware stealer trojan
Link:
https://tria.ge/reports/230324-kh5q9sdb75/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Loads dropped DLL
Reads local data of messenger clients
Uses the VBS compiler for execution
Azorult
Malware Config
C2 Extraction:
http://34.217.22.124/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Azorult
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Azorult
Create hunting rule
Author:kevoreilly
Description:Azorult Payload
Rule name:INDICATOR_EXE_Packed_SmartAssembly
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with SmartAssembly
Rule name:INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers
Rule name:pe_imphash
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1
Create hunting rule
Author:Florian Roth
Description:Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg
Rule name:SUSP_Archive_Phishing_Attachment_Characteristics_Jun22_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects characteristics of suspicious file names or double extensions often found in phishing mail attachments
Reference:https://twitter.com/0xtoxin/status/1540524891623014400?s=12&t=IQ0OgChk8tAIdTHaPxh0Vg
Rule name:Telegram_Links
Create hunting rule
Rule name:Windows_Trojan_Azorult_38fce9ea
Create hunting rule
Author:Elastic Security
Rule name:win_azorult_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.azorult.
Rule name:win_azorult_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AZORult

zip 80c8ab4dcf64f9a2bcbeb1ef6f1f8b1b7ccb55039c0bae6a9957ffed097fe6be

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments